[PATCH 1/2] tpm: sessions: bound the primary public area by the response size

[Guo Zihao]

tpm2_parse_create_primary() reads the size of the TPM2B_PUBLIC area
from the response and hashes it to compute the object name:

	len = tpm_buf_read_u16(buf, &offset_r);
	offset_t = offset_r;
	if (name) {
		/*
		 * now we have the public area, compute the name of
		 * the object
		 */
		put_unaligned_be16(TPM_ALG_SHA256, name);
		sha256(&buf->data[offset_r], len, name + 2);
	}

The length is only checked against the response later, after the
hash has been taken. A TPM that reports a public area longer than
what it actually sent makes the sha256() run past the end of the
received data and hash whatever follows the response in the buffer.

Check that the public area fits in the response before hashing it.

Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
 drivers/char/tpm/tpm2-sessions.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index ca1e2bf42..3524c1d50 100644
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -1126,6 +1126,8 @@ static int tpm2_parse_create_primary(struct tpm_chip *chip, struct tpm_buf *buf,
 		return -EINVAL;
 	len = tpm_buf_read_u16(buf, &offset_r);
 	offset_t = offset_r;
+	if (offset_r + len > tpm_buf_length(buf))
+		return -EINVAL;
 	if (name) {
 		/*
 		 * now we have the public area, compute the name of
-- 
2.50.1